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UNITED STATES DISTRICT COURT 

for the 

Eastern District of Wisconsin 


In the Matter of the Search of: 

IN THE MATTER OF THE SEARCH OF INFORMATION j 
ASSOCIATED WITH FACEBOOK USER “Dee ) 

OfFGalena” THAT IS STORED AT PREMISES ) 

CONTROLLED BY FACEBOOK INC. ) 

) 


Case No. 




APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under penalty of 
perjury that I have reason to believe that on the following person or property: 

See Attachment A 


located in the Eastern District of Wisconsin, there is now concealed: 

See Attachment B 


The basis for the search under Fed. R. Crim P. 41(c) is: 

B evidence of a crime; 

B contraband, fruits of crime, or other items illegally possessed; 

B property designed for use, intended for use, or used in committing a crime; 

□ a person to be arrested or a person who is unlawfully restrained. 

The search is related to violations of: 18 U.S.C. 844(i), 18 U.S.C. 924(c), and 26 U.S.C. 5861(d),(e),(f) 


The application is based on these facts: See attached affidavit. 

□ Delayed notice of_days (give exact ending date if more than 30 days:_) is requested 

under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 



Applicant’s signature 


Swormto before me and signed in my presence: 

PateM ^^^ JJ?/ f- 


Special Agent Timothy Rorabeck, ATF 

Printed Name and Title 



City and State: Milwai<rteRfWis4d^j-00m ?-l\M Filed 0 1 /390 WbleP&tyy Jo 3#1P3 Docij irt&atMagistrate Judge 

Printed Name and Title 




















AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Special Agent Timothy Rorabeck, being first duly sworn, hereby depose and 
state as follows: 

INTRODUCTION AND AGENT BACKGROUND 

1. I make this affidavit in support of an application for a search warrant for 
information associated with a certain Facebook user ID that is stored at premises 
owned, maintained, controlled, or operated by Facebook, a social networking company 
headquartered in Menlo Park, California. The information to be searched is described 
in the following paragraphs and in Attachment A. This affidavit is made in support of 
an application for a search warrant under 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 
2703(c)(1)(A) to require Facebook to disclose to the government records and other 
information in its possession, pertaining to the subscriber or customer associated with 
the user ID. 

2. I am employed with the Bureau of Alcohol, Tobacco, Firearms and 
Explosives (ATF) and have been so employed since September of 2014. I attended the 
Federal Law Enforcement Training Center where I completed both the Criminal 
Investigator Training Program and the ATF Special Agent Basic Training program. My 
duties as a Special Agent with ATF include investigating alleged violations of the 
federal firearms, arson, and explosives laws under the purview of the Gun Control Act 
(as amended) under Title 18 of the United States Code. Previously to that, I served in 
the United States Military and completed two tours of Duty in Iraq. During the course 
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of my career, I have had in-service trainings regarding the use of social media in 
relation to criminal investigations. Specifically, I have received instruction regarding 
the use of social media sites by criminal elements. Additionally, I have conducted 
previous criminal investigations in which internet research that I conducted yielded the 
use of social media by suspects. Specifically, I know from my training and experience 
that alleged suspects of criminal activity, who have accounts on social media websites, 
will often communicate their criminal intentions or past activity via "instant message" 
or "in-box message" on a given social media website. The "instant message" / "in-box 
message" is a private communication from one user to another. Furthermore, I know 
through experience that many social media users often use social media websites as 
their primary means to communicate with others. Additionally, I know from training 
and experience that suspects who use social media websites sometimes post 
photographs of themselves possessing incriminating items, such as narcotics and 
firearms. Also, suspects in criminal investigations have been known to post statements 
on social websites referencing their own criminal activity. 

3. The facts in this affidavit come from my personal observations, my 
training and experience, and information obtained from other agents and witnesses. 
This affidavit is intended to show merely that there is sufficient probable cause for the 
requested warrant and does not set forth all of my knowledge about this matter. 

4. Based on my training and experience and the facts as set forth in this 
affidavit, there is probable cause to believe that Derobertis JOHNSON (B/M DOB: 
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10/19/1996) has in his possession evidence of crimes committed in violations of Title 18 
U.S.C. 844(i) (Arson of Property in Interstate Commerce), 18 U.S.C 924(c) (use of a 
Molotov Cocktail to commit a federal arson crime), and 26 U.S.C. 5861(d), (e) & (f), 
(possess, transfer or making a firearm not registered in the National Firearms 
Registration and Transfer Record). 

5. Under 26 U.S.C. § 5845(a) and (f), the definition of "firearm" includes a 
"destructive device", which includes: "(1) any explosive, incendiary, or poison gas (A) 
bomb, (B) grenade, (C) rocket having a propellant charge of more than four ounces, (D) 
missile having an explosive or incendiary charge of more than one-quarter ounce, (E) 
mine, or (F) similar device;... and (3) any combination of parts either designed or 
intended for use in converting any device into a destructive device as defined in 
subparagraphs (1) and (2) and from which a destructive device may be readily 
assembled." 

6. The definition of "make" under 26 U.S.C. § 5845(i) includes 
"manufacturing (other than by one qualified to engage in such business in this chapter), 
putting together, altering, any combination of these, or otherwise producing a firearm." 

7. There is also probable cause to search the information described in 
Attachment A for evidence of these crimes, as described in Attachment B. 

IDENTIFICATION OF ITEMS TO BE SEARCHED 

8. The Facebook pages belonging to "Dee OffGalena" - ID # Unknown, 
herein described as a personal website that is accessed with a username and password 
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specific only to that page and further described in Attachment A. The following 
Facebook Page URLs, Facebook Usernames, and associated Facebook Identifications 
Numbers: The applied-for warrant would authorize the search and recovery of 
evidence particularly described in Attachment B. 

PROBABLE CAUSE 

Case Background 

9. On August 13, 2016, at about 8:45pm, several unknown subjects 
maliciously set fire to a Milwaukee Police Department (MPD) unmarked squad car 
(2005 Chevy Impala black 4 door bearing WI auto plate #740-JYE, VIN 
#2G1WF55K059378485) at 3205 North Sherman Blvd. in the city and county of 
Milwaukee, WI. This act caused over $10,000 dollars in loss and damage. 

10. On August 13, 2016, at about 9:40pm, several unknown subjects were 
involved in property damage, burglary, and malicious use of fire at the BP Gas Station 
located at 3114 North Sherman Blvd. in the city and county of Milwaukee, WI. This act 
caused over $1,000,000 in damage. At all times material to probable cause, the BP Gas 
Station was a commercial business engaged in and affecting interstate commerce. 
Through investigation, it was determined that the BP Gas Station fire was intentionally 
set and that the arson caused damage to the gas station. 

Charles N. Edwards Molotov Cocktail Investigation 

11. On August 23, 2016, ATF was contacted regarding suspected Improvised 
Incendiary Devices (IID) located within a dumpster at 3284 N. Sherman Blvd., 
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Milwaukee. ATF Special Agents traveled to the above location and discovered a brown 
cardboard box holding multiple glass bottles containing a liquid with cloth rags 
inserted into the openings. The responding agents smelled a strong odor of a petroleum 
distillate emanating from the dumpster, which is consistent with the presence of 
gasoline. From training and experience, the agents identified these devices as "Molotov 
Cocktails". Some of the glass bottles holding the liquid and cloth wicks were labeled as 
Mike's Hard Lemonade, Everfresh Juice, Mystic, and Seagram's Wine Coolers. 

12. On August 29, 2016, law enforcement conducted a search warrant at the 
residence of Van L. Mayes, which was located at 2746A N. 49 th Street, Milwaukee. Law 
enforcement agents observed a full bottle of a Seagram's Wine Cooler and one empty 
bottle of Everfresh Juice. These bottles were consistent with the types of bottles used in 
the construction of the Molotov Cocktails recovered by law enforcement on August 23, 
2016, from the dumpster located at 3284 N. Sherman Blvd., Milwaukee. During the 
search warrant, Mayes told law enforcement agents that he transported two gasoline 
cans and Seagram's Wine Cooler bottles to a man named "Charles" who uses a 
wheelchair and resides around Sherman Blvd., Milwaukee. Mayes further stated that he 
left the two cans of gasoline at Charles' residence. 

13. On August 30,2016, Milwaukee County Judge Timothy Witkowiak signed 
a search warrant for Charles N. Edwards' residence located at 3284 N. Sherman 
Boulevard Apartment #2, Milwaukee, to search for evidence of narcotics and guns. 
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14. During the search of Charles N. Edwards' residence on August 30, 2016, 
law enforcement agents located two empty gas cans inside of a bedroom; a gas can 
nozzle within the apartment's yard; and bottle caps in the yard that were consistent 
with the types of bottles used to construct the Molotov Cocktails that were recovered on 
August 23,2016. 

15. An inquiry into the National Firearm Registration and Transfer Record 
revealed that Charles N. Edwards was not of record. 

BP Gas Station Arson Investigation 

20. Information was developed through the course of the investigation that 
led to the arrest of a juvenile, A.T. On September 14, 2016, A.T. was questioned by law 
enforcement agents. A.T. stated that he was at the BP Gas Station, located at 3114 N. 
Sherman Blvd., Milwaukee, on the evening of August 13, 2016. A.T. stated that he was 
standing next to "D" (Later identified as Derobertis JOHNSON) and another juvenile, 
R.M who had "Cocktails" "Bottles with fire in them". A.T. described the Cocktails as 
glass bottles, open, with paper in the top. A.T. related that when he threw his Molotov 
cocktail, R.M. was on his right side, and JOHNSON was on his left side. A.T. related 
that JOHNSON had traveled to the area of the Beauty Supply shop, but A.T. did not 
follow. 

21. On November 29, 2016, A.T. was questioned by law enforcement agents. 
A.T. stated JOHNSON'S Facebook username was "Dee OffGalena". A.T. related that on 
the evening of August 13, 2016, at the BP Gas Station, A.T. described seeing Charles 
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Edwards behind the BP Gas Station with a bag in his lap. Later on, R.M. and 
JOHNSON came from behind the BP Gas Station with Molotov Cocktails. A.T. 
indicated JOHNSON had two Molotov Cocktails in his possession and gave one to A.T. 
A.T. stated JOHNSON threw a Molotov Cocktail at the vehicle to A.T/s left and A.T. 
threw an unlit Molotov Cocktail at the car in the middle. 

22. An inquiry into the National Firearm Registration and Transfer Record 
revealed that JOHNSON was not of record. 

23. On November 22, 2016, ATF SA Rick Hankins screen captured two 
Facebook postings that were posted by Facebook username "Dee OffGalena". The first 
captured screen shot was a posting conversation that took place on August 30, 2016. 
That conversation is as follows: "Dee OffGalena": Fuck I Look Like Turning MySelf 

In.Yuhh Playing All In Yo Asz. "ForeverFoes DayGutta": On wat doe but wya bro 

(possibly meaning what happened and where are you at?). "Dee OffGalena": Inbox Me! 
The second captured screen shot was an article from Fox 6 News with the headline 
reading as follows: Man charged with burglary of 3 businesses in Sherman Park 
neighborhood. 

24. Affiant believes additional information relevant to the BP Gas Station 
arson and other crimes related to arson and creating Molotov Cocktails is housed 
within the Facebook account Unknown with listed the User ID as "Dee OffGalena". 
Additional relevant information includes pictures, text, and geographic information 
that will assist in identifying the BP arson suspects. 
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FACEBOOK INFORMATION 


25. Facebook owns and operates a free-access social networking website of 
the same name that can be accessed at http://www.facebook.com. Facebook allows its 
users to establish accounts with Facebook, and users can then use their accounts to 
share written news, photographs, videos, and other information with other Facebook 
users, and sometimes with the general public. 

26. Facebook asks users to provide basic contact and personal identifying 
information to Facebook, either during the registration process or thereafter. This 
information may include the user's full name, birth date, gender, contact e-mail 
addresses, Facebook passwords, Facebook security questions and answers (for 
password retrieval), physical address (including city, state, and zip code), telephone 
numbers, screen names, websites, and other personal identifiers. Facebook also assigns 
a user identification number to each account. 

27. Facebook users may join one or more groups or networks to connect and 
interact with other users who are members of the same group or network. Facebook 
assigns a group identification number to each group. A Facebook user can also connect 
directly with individual Facebook users by sending each user a "Friend Request." If the 
recipient of a "Friend Request" accepts the request, then the two users will become 
"Friends" for purposes of Facebook and can exchange communications or view 
information about each other. Each Facebook user's account includes a list of that 
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user's "Friends" and a "News Feed," which highlights information about the user's 
"Friends," such as profile changes, upcoming events, and birthdays. 

28. Facebook users can select different levels of privacy for the 
communications and information associated with their Facebook accounts. By 
adjusting these privacy settings, a Facebook user can make information available only 
to himself or herself, to particular Facebook users, or to anyone with access to the 
Internet, including people who are not Facebook users. A Facebook user can also create 
"lists" of Facebook friends to facilitate the application of these privacy settings. 
Facebook accounts also include other account settings that users can adjust to control, 
for example, the types of notifications they receive from Facebook. 

29. Facebook users can create profiles that include photographs, lists of 
personal interests, and other information. Facebook users can also post "status" 
updates about their whereabouts and actions, as well as links to videos, photographs, 
articles, and other items available elsewhere on the Internet. Facebook users can also 
post information about upcoming "events," such as social occasions, by listing the 
event's time, location, host, and guest list. In addition, Facebook users can "check in" to 
particular locations or add their geographic locations to their Facebook posts, thereby 
revealing their geographic locations at particular dates and times. A particular user's 
profile page also includes a "Wall," which is a space where the user and his or her 
"Friends" can post messages, attachments, and links that will typically be visible to 
anyone who can view the user's profile. 
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30. Facebook allows users to upload photos and videos, which may include 
any metadata such as location that the user transmitted when s/he uploaded the photo 
or video. It also provides users the ability to "tag" (i.e., label) other Facebook users in a 
photo or video. When a user is tagged in a photo or video, he or she receives a 
notification of the tag and a link to see the photo or video. For Facebook's purposes, the 
photos and videos associated with a user's account will include all photos and videos 
uploaded by that user that have not been deleted, as well as all photos and videos 
uploaded by any user that have that user tagged in them. 

31. Facebook users can exchange private messages on Facebook with other 
users. These messages, which are similar to e-mail messages, are sent to the recipient's 
"Inbox" on Facebook, which also stores copies of messages sent by the recipient, as well 
as other information. Facebook users can also post comments on the Facebook profiles 
of other users or on their own profiles; such comments are typically associated with a 
specific posting or item on the profile. In addition, Facebook has a Chat feature that 
allows users to send and receive instant messages through Facebook. These chat 
communications are stored in the chat history for the account. Facebook also has a 
Video Calling feature, and although Facebook does not record the calls themselves, it 
does keep records of the date of each call. 

32. If a Facebook user does not want to interact with another user on 
Facebook, the first user can "block" the second user from seeing his or her account. 
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33. Facebook has a "like" feature that allows users to give positive feedback 

or connect to particular pages. Facebook users can "like" Facebook posts or updates, as 
well as webpages or content on third-party (i.e., non-Facebook) websites. Facebook 
users can also become "fans" of particular Facebook pages. i 

34. Facebook has a search function that enables its users to search Facebook 
for keywords, usernames, or pages, among other things. 

35. Each Facebook account has an activity log, which is a list of the user's 
posts and other Facebook activities from the inception of the account to the present. 
The activity log includes stories and photos that the user has been tagged in, as well as 
connections made through the account, such as "liking" a Facebook page or adding 
someone as a friend. The activity log is visible to the user but cannot be viewed by 
people who visit the user's Facebook page. 

36. Facebook Notes is a blogging feature available to Facebook users, and it 
enables users to write and post notes or personal web logs ("blogs"), or to import their 
blogs from other services, such as Xanga, Livejournal, and Blogger. 

37. The Facebook Gifts feature allows users to send virtual "gifts" to their 
friends that appear as icons on the recipient's profile page. Gifts cost money to 
purchase, and a personalized message can be attached to each gift. Facebook users can 
also send each other "pokes," which are free and simply result in a notification to the 
recipient that he or she has been "poked" by the sender. 
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38. Facebook also has a Marketplace feature, which allows users to post free 
classified ads. Users can post items for sale, housing, jobs, and other items on the 
Marketplace. 

39. In addition to the applications described above, Facebook also provides its 
users with access to thousands of other applications ("apps") on the Facebook platform. 
When a Facebook user accesses or uses one of these applications, an update about that 
the user's access or use of that application may appear on the user's profile page. 

40. Some Facebook pages are affiliated with groups of users, rather than one 
individual user. Membership in the group is monitored and regulated by the 
administrator or head of the group, who can invite new members and reject or accept 
requests by users to enter. Facebook can identify all users who are currently registered 
to a particular group and can identify the administrator and/or creator of the group. 
Facebook uses the term "Group Contact Info" to describe the contact information for 
the group's creator and/or administrator, as well as a PDF of the current status of the 
group profile page. 

41. Facebook uses the term "Neoprint" to describe an expanded view of a 
given user profile. The "Neoprint" for a given user can include the following 
information from the user's profile: profile contact information; News Feed 
information; status updates; links to videos, photographs, articles, and other items; 
Notes; Wall postings; friend lists, including the friends' Facebook user identification 
numbers; groups and networks of which the user is a member, including the groups' 
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Facebook group identification numbers; future and past event postings; rejected 
"Friend" requests; comments; gifts; pokes; tags; and information about the user's access 
and use of Facebook applications. 

42. Facebook also retains Internet Protocol ("IP") logs for a given user ID or IP 
address. These logs may contain information about the actions taken by the user ID or 
IP address on Facebook, including information about the type of action, the date and 
time of the action, and the user ID and IP address associated with the action. For 
example, if a user views a Facebook profile, that user's IP log would reflect the fact that 
the user viewed the profile, and would show when and from what IP address the user 
did so. 

43. Social networking providers like Facebook typically retain additional 
information about their users' accounts, such as information about the length of service 
(including start date), the types of service utilized, and the means and source of any 
payments associated with the service (including any credit card or bank account 
number). In some cases, Facebook users may communicate directly with Facebook 
about issues relating to their accounts, such as technical problems, billing inquiries, or 
complaints from other users. Social networking providers like Facebook typically retain 
records about such communications, including records of contacts between the user and 
the provider's support services, as well as records of any actions taken by the provider 
or user as a result of the communications. 
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44. As explained herein, information stored in connection with a Facebook 
account may provide crucial evidence of the "who, what, why, when, where, and how" 
of the criminal conduct under investigation, thus enabling the United States to establish 
and prove each element or alternatively, to exclude the innocent from further suspicion. 
In my training and experience, a Facebook user's "Neoprint," IP log, stored electronic 
communications, and other data retained by Facebook, can indicate who has used or 
controlled the Facebook account. This "user attribution" evidence is analogous to the 
search for "indicia of occupancy" while executing a search warrant at a residence. For 
example, profile contact information, private messaging logs, status updates, and 
tagged photos (and the data associated with the foregoing, such as date and time) may 
be evidence of who used or controlled the Facebook account at a relevant time. Further, 
Facebook account activity can show how and when the account was accessed or used. 
For example, as described herein, Facebook logs the Internet Protocol (IP) addresses 
from which users access their accounts along with the time and date. By determining 
the physical location associated with the logged IP addresses, investigators can 
understand the chronological and geographic context of the account access and use 
relating to the crime under investigation. Such information allows investigators to 
understand the geographic and chronological context of Facebook access, use, and 
events relating to the crime under investigation. Additionally, Facebook builds geo¬ 
location into some of its services. Geo-location allows, for example, users to "tag" their 
location in posts and Facebook "friends" to locate each other. This geographic and 
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timeline information may tend to either inculpate or exculpate the Facebook account 
owner. Last, Facebook account activity may provide relevant insight into the Facebook 
account owner's state of mind as it relates to the offense under investigation. For 
example, information on the Facebook account may indicate the owner's motive and 
intent to commit a crime (e.g., information indicating a plan to commit a crime), or 
consciousness of guilt (e.g., deleting account information in an effort to conceal 
evidence from law enforcement). 

45. Therefore, the computers of Facebook are likely to contain all the material 
described above, including stored electronic communications and information 
concerning subscribers and their use of Facebook, such as account access information, 
transaction information, and other account information. 

INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED 

46. I anticipate executing this warrant under the Electronic Communications 
Privacy Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 2703(c)(1)(A), by using 
the warrant to require Facebook to disclose to the government copies of the records and 
other information (including the content of communications) particularly described in 
Section I of Attachment B. Upon receipt of the information described in Section I of 
Attachment B, government-authorized persons will review that information to locate 
the items described in Section II of Attachment B. 
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CONCLUSION 


47. Based on the forgoing, I request that the Court issue the proposed search 
warrant. 

48. This Court has jurisdiction to issue the requested warrant because it is "a 
court of competent jurisdiction" as defined by 18 U.S.C. § 2711. 18 U.S.C. §§ 2703(a), 
(b)(1)(A) & (c)(1)(A). Specifically, the Court of the Eastern District of Wisconsin is a 
district court of the United States that has jurisdiction over the offense(s) being 
investigated, 18 U.S.C. § 2711(3)(A)(i).] Pursuant to 18 U.S.C. § 2703(g), the presence of 
a law enforcement officer is not required for the service or execution of this warrant. 
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ATTACHMENT A 


Property to Be Searched 

This warrant applies to information between August 12, 2016 and the present 
date associated with Derobertis Johnson's Facebook user ID "Dee OffGalena" - ID # 
Unknown that is stored at premises owned, maintained, controlled, or operated by 
Facebook, a company headquartered in Menlo Park, California. 
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ATTACHMENT B 


Particular Things to be Seized 
I. Information to be disclosed by Facebook 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Facebook, including any messages, records, files, logs, or 
information that have been deleted but are still available to Facebook, or have been 
preserved pursuant to a request made under 18 U.S.C. § 2703(f), Facebook is required to 
disclose the following information to the government for each user ID listed in 
Attachment A: 

a. All contact and personal identifying information, including: full name, 
user identification number, birth date, gender, contact e-mail addresses, 
Facebook passwords, Facebook security questions and answers, physical 
address (including city, state, and zip code), telephone numbers, screen 
names, websites, and other personal identifiers. 

b. All activity logs for the account and all other documents showing the 
user's posts and other Facebook activities; 

c. All photos uploaded by that user ID and all photos uploaded by any user 
that have that user tagged in them; 

d. All profile information; News Feed information; status updates; links to 
videos, photographs, articles, and other items; Notes; Wall postings; 
friend lists, including the friends' Facebook user identification numbers; 
groups and networks of which the user is a member, including the 
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groups' Facebook group identification numbers; future and past event 
postings; rejected "Friend" requests; comments; gifts; pokes; tags; and 
information about the user's access and use of Facebook applications; 

e. All other records of communications and messages made or received by 
the user, including all private messages, chat history, video calling history, 
and pending "Friend" requests; 

f. All "check ins" and other location information; 

g. All IP logs, including all records of the IP addresses that logged into the 
account; 

h. All records of the account's usage of the "Like" feature, including all 
Facebook posts and all non-Facebook webpages and content that the user 
has "liked"; 

i. All information about the Facebook pages that the account is or was a 
"fan" of; 

j. All past and present lists of friends created by the account; 

k. All records of Facebook searches performed by the account; 

l. All information about the user's access and use of Facebook Marketplace; 

m. The types of service utilized by the user; 

n. The length of service (including start date) and the means and source of 
any payments associated with the service (including any credit card or 
bank account number); 
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o. All privacy settings and other account settings, including privacy settings 
for individual Facebook posts and activities, and all records showing 
which Facebook users have been blocked by the account; 

p. All records pertaining to communications between Facebook and any 
person regarding the user or the user's Facebook account, including 
contacts with support services and records of actions taken. 

II. Information to be seized by the government 

All information described above in Section I that constitutes fruits, evidence and 
instrumentalities of violations of Title 18 U.S.C. 844(i) (arson of property in interstate 
commerce), 18 U.S.C 924(c) (use of a Molotov Cocktail to commit a federal arson crime), 
and 26 U.S.C. 5861(d), (e) & (f), (possess, transfer or making a firearm not registered in 
the National Firearms Registration and Transfer Record) since August 12, 2016 for each 
user ID identified on Attachment A, information pertaining to the following matters: 

(a) The relevant offense conduct, any preparatory steps taken in furtherance 
of the scheme, communications between JOHNSON and others related to 
the relevant offense conduct of commercial arson, possessing or making 
Molotov Cocktails, and possessing Molotov Cocktails while committing a 
crime of violence. 

(b) Evidence indicating how and when the Facebook account was accessed or 
used, to determine the chronological and geographic context of account 
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access, use, and events relating to the crime under investigation and to the 
Facebook account owner; 

(c) Evidence indicating the Facebook account owner's state of mind as it 
relates to the crime under investigation; 

(d) The identity of the person(s) who created or used the user ID, including 
records that help reveal the whereabouts of such person(s). 

(e) The identity of the person(s) who communicated with the user ID about 
matters relating to relevant offense conduct of commercial arson, 
possessing or making Molotov Cocktails, and possessing Molotov 
Cocktails while committing a crime of violence, including records that 
help reveal their whereabouts. 


4 
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CERTIFICATE OF AUTHENTICITY OF DOMESTIC BUSINESS 
RECORDS PURSUANT TO FEDERAL RULE OF EVIDENCE 902(11) 


I,_, attest, under penalties of perjury under 

the laws of the United States of America pursuant to 28 U.S.C. § 1746, that the 
information contained in this declaration is true and correct. I am employed by 

Facebook, and my official title is_. I am a custodian of 

records for Facebook. I state that each of the records attached hereto is the original 
record or a true duplicate of the original record in the custody of Facebook, and that I 

am the custodian of the attached records consisting of_ 

(pages/CDs/kilobytes). I further state that: 

a. all records attached to this certificate were made at or near the time of the 
occurrence of the matter set forth, by, or from information transmitted by, a person with 
knowledge of those matters; 

b. such records were kept in the ordinary course of a regularly conducted business 
activity of Facebook; and 

c. such records were made by Facebook as a regular practice. 

I further state that this certification is intended to satisfy Rule 902(11) of the 
Federal Rules of Evidence. 


Date 


Signature 
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